Legal

Sub-Processor List

Last updated: 6 October 2026

BizAI (Tulsapax Group (Pty) Ltd) engages the following third-party sub-processors to provide the Smart CRM, Voice Valet, WhatsApp Business API, and AI Inbox services. This list is published in accordance with our obligations under the Protection of Personal Information Act 4 of 2013 (POPIA) Section 72, which requires us to disclose when personal information is transferred outside South Africa and to confirm that adequate protections are in place.

We are responsible for ensuring each sub-processor provides equivalent data protection obligations as required by POPIA Section 21(2). We maintain Data Processing Agreements with each sub-processor listed below.

Active Sub-Processors

Supabase Inc.

📍 Singapore (AWS ap-southeast-1)

Purpose: Primary database — CRM contact records, conversation history, pipeline data, authentication

Services: Smart CRM, All services

Protection basis: Singapore Personal Data Protection Act 2012 (amended 2021); Supabase Data Processing Agreement

Anthropic PBC

📍 United States of America

Purpose: AI-assisted features — inbox assistant, lead scoring, message summaries, AI responses (message content only; identity documents and financial records are excluded)

Services: Smart CRM AI features, Voice Valet AI, AI Inbox

Protection basis: POPIA Section 72(1)(b) — necessary for performance of service; Anthropic Usage Policy and data agreements

Vercel Inc.

📍 United States of America

Purpose: Application hosting and content delivery — serves the BizAI web application and API layer

Services: All services

Protection basis: POPIA Section 72(1)(b) — necessary for performance of service; Vercel Data Processing Addendum

Meta Platforms, Inc.

📍 United States of America

Conditional

Purpose: WhatsApp Business API — message delivery, template management, phone number verification, delivery receipts

Services: WhatsApp Business API (where activated)

Protection basis: POPIA Section 72(1)(b) — necessary for WhatsApp service; Meta Business Terms and Data Processing Terms

Deepgram Inc.

📍 United States of America

Conditional

Purpose: Speech-to-text transcription — converts Voice Valet call audio to text for AI processing and message logging

Services: Voice Valet (where activated)

Protection basis: POPIA Section 72(1)(b) — necessary for performance of service; Deepgram Data Processing Agreement

ElevenLabs Inc.

📍 United States of America

Conditional

Purpose: Text-to-speech synthesis — converts AI-generated responses to natural-sounding voice for Voice Valet calls

Services: Voice Valet (where activated)

Protection basis: POPIA Section 72(1)(b) — necessary for performance of service; ElevenLabs Data Processing Agreement

Twilio Inc.

📍 United States of America

Conditional

Purpose: Telephony infrastructure — inbound and outbound call routing, phone number provisioning, call recording (where enabled)

Services: Voice Valet (where activated)

Protection basis: POPIA Section 72(1)(b) — necessary for performance of service; Twilio Data Processing Agreement

Twilio SendGrid

📍 United States of America

Conditional

Purpose: Email delivery — sends emails from the platform (quotes, invoices, notifications)

Services: Smart CRM email sending (where used)

Protection basis: POPIA Section 72(1)(b) — necessary for performance of service; Twilio Data Processing Agreement

Sage (Sage Business Cloud Accounting / Sage Evolution)

📍 As set by Sage for the client's own Sage company

Conditional

Purpose: Accounting integration — sends customers, products, quotes and invoices to the client's own Sage company

Services: Smart CRM accounting integration (where the client connects Sage)

Protection basis: Processed in the client's own Sage account under the client's agreement with Sage

Sub-processors marked Conditional are only engaged when the relevant service feature is activated for your account.

Your Rights

As a BizAI client (Responsible Party under POPIA), you have authorised these transfers through our Data Processing Agreement, which forms part of our Terms of Service. If you would like a signed copy, email legal@bizai.co.za.

As an end user whose personal information is processed through a BizAI client's account, you may exercise your POPIA data subject rights (access, correction, deletion, objection) by contacting the business that holds your information directly. BizAI will assist that business in responding to your request.

Updates to this List

We will notify existing clients via email (support@bizai.co.za) of any material changes to sub-processors — including additions, removals, or location changes — before those changes take effect, giving you the opportunity to object if required by POPIA Section 72(5). This page is updated each time a change is made.

Questions?

For questions about our sub-processors, data processing practices, or your rights under POPIA:

Legal: legal@bizai.co.za

Support: support@bizai.co.za

Tulsapax Group (Pty) Ltd trading as BizAI · Registered in South Africa